#1Tools for acquiring, preserving, and analyzing digital evidence for legal or investigative purposes.
Kitploit recommended
deepfence/packetstreamer⭐ ⭐ Distributed tcpdump for cloud native environments ⭐ ⭐
yelparchive/osxcollectorA forensic evidence collection & analysis toolkit for OS X
google/stenographerStenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those…
cisco-talos/pyreboxPython scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU
blackberry/pe_treePython module for viewing Portable Executable (PE) files in a tree-view using pefile and PyQt5. Can also be used with IDA Pro and Rekall to dump…
mandiant/threatpursuit-vmThreat Pursuit Virtual Machine (VM): A fully customizable, open-sourced Windows-based distribution focused on threat intelligence analysis and…
mozilla/migDistributed & real time digital forensics at the speed of the cloud
snovvcrash/usbripTracking history of USB events on GNU/Linux
robindavid/lsb-steganographyPython program to steganography files into images using the Least Significant Bit.
itm4n/ppldumpDump the memory of a PPL with a userland exploit
mandiant/silketwC# wrapper for ETW that serializes kernel and user-mode event data to JSON for threat hunting, malware analysis, and incident response, with Yara…
grapl-security/graplGraph platform for Detection and Response
mandiant/mandiant-azure-ad-investigatorRead-only PowerShell module for detecting UNC2452 and other threat actor artifacts in Azure AD, auditing federated domains, service principals,…
maldev-academy/dumpchromesecretsExtract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks
intezer/linux-explorerEasy-to-use live forensics toolbox for Linux endpoints
nowsecure/android-forensicsOpen source Android Forensics app and framework
memn0ps/matrix-rsRusty Hypervisor - Windows Kernel Blue Pill Type-2 Hypervisor in Rust (Codename: Matrix)
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
